CVE-2026-39983: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39983 is an FTP command injection vulnerability in the basic-ftp Node.js library (CWE-93) that allows unauthenticated remote attackers to inject arbitrary FTP commands via CRLF sequences (\r\n) embedded in file path parameters. It affects all versions of basic-ftp prior to 5.2.1, with version 5.2.0 confirmed vulnerable. The vulnerability was published on April 9, 2026, and a fix was released the same day. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory). IBM products including App Connect Enterprise, API Connect, Cloud Pak for Security, and QRadar Suite Software are also affected as downstream consumers of the library (IBM Advisory).

The root cause is improper neutralization of CRLF sequences (CWE-93) arising from two interacting code patterns. First, the protectWhitespace() helper in Client.ts only handles leading spaces and does not strip or reject \r (0x0D) or \n (0x0A) characters from path strings. Second, FtpContext.send() writes the resulting command string directly to the TCP control socket with \r\n appended, meaning any embedded CRLF in the path causes the FTP server to interpret the payload as multiple distinct commands. All high-level path APIs — cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir() — are affected because they all route through protectWhitespace() and send(). No authentication or user interaction is required; an attacker only needs to control a file path parameter passed to the library (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker to inject and execute arbitrary FTP protocol commands on the connected FTP server. This can result in unauthorized file deletion (DELE), directory creation or removal (MKD/RMD), unintended file downloads (RETR), session termination (QUIT), and — on FTP servers supporting SITE EXEC — potential server-side command execution. The CVSS assessment reflects high integrity impact, low confidentiality impact, and low availability impact, meaning data modification and deletion are the primary risks, with limited data exposure and service disruption as secondary concerns (GitHub Advisory).

A functional proof-of-concept (PoC) exploit is publicly available in the official GitHub security advisory, consisting of runnable JavaScript (ftp-server-mock.js and poc.js) that demonstrates CRLF injection against a mock FTP server (GitHub Advisory). A separate GitHub repository (zebbernCVE/CVE-2026-39983) references the advisory but contains no functional exploit code. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.07 (7%), indicating a relatively low but non-negligible probability of exploitation in the near term (Feedly).

1. Identify a target application: Find a web application or service that uses basic-ftp (versions < 5.2.1) and accepts user-controlled input for FTP file path parameters (e.g., a file download or upload feature backed by an FTP server).
2. Craft a malicious path payload: Construct a path string containing an embedded CRLF sequence followed by the desired injected FTP command, e.g., harmless.txt\r\nDELE /important-file.txt.
3. Submit the payload: Pass the malicious path to any of the vulnerable API methods — for example, trigger client.cd("harmless.txt\r\nDELE /important-file.txt") or client.remove("decoy.txt\r\nDELE /secret-data.txt") through the application's interface.
4. Command injection occurs: The protectWhitespace() function passes the path unchanged, and FtpContext.send() writes CWD harmless.txt\r\nDELE /important-file.txt\r\n to the FTP control socket. The FTP server parses this as two separate commands: CWD harmless.txt and DELE /important-file.txt.
5. Achieve objective: The injected command executes on the FTP server — files are deleted, directories are manipulated, or additional commands (e.g., RETR, SITE EXEC) are run depending on server capabilities and attacker goals (GitHub Advisory).

• Network: Unexpected FTP control channel traffic containing multiple commands in a single TCP segment; FTP sessions where a single client request results in multiple server-side command executions (e.g., CWD followed immediately by DELE or RETR).
• FTP Server Logs: Log entries showing command sequences that do not match expected application behavior — for example, a DELE or RMD command appearing immediately after a CWD command within the same session without a separate client request; commands targeting files outside the expected working directory.
• Application Logs: Node.js application errors or exceptions referencing basic-ftp path handling if the patched version's control character check is triggered; unexpected FTP operation failures logged by the application.
• File System (FTP Server): Unexplained deletion, creation, or modification of files and directories on the FTP server that do not correspond to legitimate user activity (GitHub Advisory).

Primary fix: Upgrade basic-ftp to version 5.2.1 or later. The patch adds a control character check in protectWhitespace() that throws an error if \r, \n, or null bytes are detected in any path parameter (Patch Commit, Release v5.2.1). Workaround (if immediate upgrade is not possible): Sanitize all path inputs before passing them to basic-ftp by rejecting strings containing \r or \n characters. IBM products: Apply the corresponding IBM security updates for App Connect Enterprise, API Connect, Cloud Pak for Security, and QRadar Suite Software as detailed in the respective IBM advisories (IBM ACE Advisory, IBM API Connect).

IBM issued multiple security bulletins acknowledging the vulnerability's impact on App Connect Enterprise, API Connect, IBM Bob, and QRadar Suite Software, providing product-specific remediation guidance (IBM Advisory). The vulnerability was noted on social media platforms including Bluesky and Mastodon shortly after disclosure, with community aggregators such as CVEFeed and VulnDB picking it up within hours of publication. Red Hat also issued errata (RHSA-2026:9742 and RHSA-2026:13826) addressing the vulnerability in affected Red Hat products. The security community response was largely focused on the straightforward nature of the fix and the broad downstream impact on enterprise software stacks that bundle basic-ftp.